Re: [Zope-dev] security issue

2003-08-14 Thread Dieter Maurer 
Toby Gustafson wrote at 2003-8-14 04:35 -0700:
  ...
 I am having a problem accessing a function defined in a product I have
  created and installed.
  ...
  From that script I try to call the
  function with the lines:
  
 from Products.StoreEvent import StoreEvent
  
 ...
  
 storeEvents = StoreEvents.searchForStoreEvents(context, ...)
  
  ...
  You are not allowed to access searchForStoreEvents in this
  context.
  
  I have read the security document at:
  
 http://www.zope.org/Documentation/Books/ZDG/current/Security.stx
  
  and have tried adding several things to my StoreEvent.__init__.py file,
  such as:
  
 modulesecurity = ModuleSecurityInfo()
 modulesecurity.declarePublic( \
   'Products.StoreEvent.searchForStoreEvents')
 modulesecurity.apply(globals())

ModuleSecurityInfo is quite complex. I do not understand it completely.

However, I see one error in your code: in your declarePublic,
one StoreEvent is missing.
Your seachForStoreEvents is at
'Products.StoreEvent.StoreEvent.searchForStoreEvents'

  However, nothing seems to work.  Anybody have any idea what I am doing
  wrong.

The AccessControl.allow_module may be simpler to use
(however, it make available the complete module content).


Dieter

___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope )

[Zope-dev] security issue

2003-08-14 Thread Toby Gustafson 

Hello,

   I am having a problem accessing a function defined in a product I have
created and installed.

   The product is called StoreEvent, and it was created using the
PloneMinimalInstall as a guide.

   In the StoreEvent product is a file called StoreEvent, which contains a
function searchForStoreEvents.  This function is outside of the StoreEvent
class which is also defined in the file.

   I have created a page template which contains a form, and when the form
is submitted, a script is executed.  From that script I try to call the
function with the lines:

   from Products.StoreEvent import StoreEvent

   ...

   storeEvents = StoreEvents.searchForStoreEvents(context, ...)

When I bring up the page and submit it, I get a popup asking me to enter a
username and password.  When I cancel that, I get an error page with the
message You are not allowed to access searchForStoreEvents in this
context.

I have read the security document at:

   http://www.zope.org/Documentation/Books/ZDG/current/Security.stx

and have tried adding several things to my StoreEvent.__init__.py file,
such as:

   modulesecurity = ModuleSecurityInfo()
   modulesecurity.declarePublic( \
 'Products.StoreEvent.searchForStoreEvents')
   modulesecurity.apply(globals())

However, nothing seems to work.  Anybody have any idea what I am doing
wrong.

Thanks in advance,
--Toby.
---
Toby Gustafson
Senior Software Engineer
Tyrell Software Corporation
Email: [EMAIL PROTECTED]
---



___
Zope-Dev maillist  -  [EMAIL PROTECTED]
http://mail.zope.org/mailman/listinfo/zope-dev
**  No cross posts or HTML encoding!  **
(Related lists - 
 http://mail.zope.org/mailman/listinfo/zope-announce
 http://mail.zope.org/mailman/listinfo/zope )